Skip to content

Instantly share code, notes, and snippets.

@bortzmeyer

bortzmeyer/gist:2605348

Created May 5, 2012 20:21
Show Gist options
  • Star 7 You must be signed in to star a gist
  • Fork 2 You must be signed in to fork a gist
  • Save bortzmeyer/2605348 to your computer and use it in GitHub Desktop.
Save bortzmeyer/2605348 to your computer and use it in GitHub Desktop.
Download ZIP
Sample Apache's mod_security rules for rate-limiting
Raw
gistfile1.txt
# Activates mod_security
SecRuleEngine On
# Only filters requests for /toto
SecRule REQUEST_FILENAME "!^/toto" "phase:1,skip:5,nolog"
# Only filters requests for rosalind
SecRule REQUEST_HEADERS:Host "rosalind\.abgenomica\.com" "phase:1,skip:5,nolog"
# Stores the number of visits in variable IP.pagecount
SecAction "phase:1,nolog,initcol:IP=%{REMOTE_ADDR},setvar:IP.pagecount=+1,expirevar:IP.pagecount=60"
# Denies requests when excessive
# 429 would be a better error status but mod_security rewrites it as 500 :-(
SecRule IP:PAGECOUNT "@gt 3" "phase:1,deny,status:403,msg:'Too many requests'"
@slrslr
Copy link

slrslr commented Mar 6, 2017

This seems to be outdated, current mod security seems to require ids in rules and also it shows this warning: ModSecurity: Invalid value for action ID XY
XY = line with > SecRule IP:PAGECOUNT "@gt 3" "phase:1,deny,status:403,msg:'Too many requests'"

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment